VulnSocial

CVE-2026-35674Active Exploitation(openclaw / openclaw)

MEDIUMCVSS 8.7 · HIGH

Exploitation ongoing with high activity in latest observed window (1 mentions)

Immediate actions

  • Prioritize remediation for openclaw openclaw systems immediately
  • Assume compromise if assets are exposed
  • Hunt for exploitation attempts and persistence artifacts
  • Increase monitoring for publicly documented tradecraft
  • Track advisory updates for patch or workaround availability

Recommended action window: Immediate (within 24h)

NVD description

OpenClaw before 2026.5.18 contains a scope bypass vulnerability in the Gateway chat.send route that allows scoped clients to execute privileged commands. Attackers with operator.write scope can deliver commands through inherited external routes to bypass operator.approvals and operator.admin scope requirements, enabling unauthorized plugin, config, MCP, allowlist, and ACP mutations.

openclaw CVEsBack to dashboard
5.0/ 10 priority

Sources & remediation

Vendor / third-party advisories
Weakness type (CWE)
CWE-863

Priority

MEDIUM

Exploitation

ACTIVE

PoC

YES

Patch

NONE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • openclaw

Threat summary

  • Active exploitation appears in 1 classified signals
  • Public PoC is present in monitored signal
  • 2 mentions across 2 observed days
  • Momentum state: stable

What's happening

  • Active exploitation reported across 1 signal
  • PoC mentioned or linked in 1 signal
  • Disclosure: 1 classified signal
  • Peaked 1d ago at 1 mentions (2026-05-30); latest day: 1
  • 2 total mentions across 2 days

Affected systems

Vendors
openclaw
Products
openclaw

Deep dive

Activity timeline2 mentions / 2d
00111Mentions · 2026-05-30: 1Mentions · 2026-07-02: 1PoC Mentioned / Linked · 2026-05-30: 1Active Exploitation · 2026-05-30: 105-3007-02
Signal classification2 categories
Active Exploitation
150.0%
Disclosure
150.0%
Referenced assets2 URLs
Classification over time
DateTotalLabels
2026-05-301
Active Exploitation1
2026-07-021
Disclosure1
Full discourse2 posts
  • Hugo | DevOps | Cybersecurity 🇱🇻@HugoValters
    Active Exploitation

    #Openclaw has an active #CVE #CVEalert More information, POC Labs based in isolated docker, SIGMA, YARA Rules and etc available https://www.valtersit.com/cve/CVE-2026-35674/ #devops #devsecops #sysadmin #infosec #cybersecurity

    Post summary

    The tweet announces an active alert for CVE-2026-35674, links to PoC labs and detection rules, but provides no patch information or technical details.

    01010181
    906 followersView on X
  • DailyCVE@dailycve
    Disclosure

    🔴 OpenClaw, Scope Bypass, #CVE-2026-35674 (High) -DC-Jul2026-831 https://dailycve.com/openclaw-scope-bypass-cve-2026-35674-high-dc-jul2026-831/

    Post summary

    The tweet announces CVE-2026-35674, describing a high‑severity scope‑bypass vulnerability in OpenClaw, without providing PoC, exploit, or mitigation details.

    0000095
    218 followersView on X
CPE platform detail1 entries

1 of 1 entries

PartVendorProductVersionTarget SWTarget HW
Appopenclawopenclaw-node.js-

Explore more

Back to dashboardopenclaw CVEsopenclaw vulnerabilities